CVE-2024-20741: Adobe Substance 3D Painter RCE Vulnerability

CVE-2024-20741 Overview

CVE-2024-20741 affects Adobe Substance 3D Painter versions 9.1.1 and earlier. The vulnerability is a Write-what-where Condition [CWE-123] that also involves an Out-of-bounds Write [CWE-787]. Successful exploitation results in arbitrary code execution in the context of the current user.

Exploitation requires user interaction. A victim must open a malicious file crafted by the attacker. The attack vector is local, and no privileges are required beyond the ability to open the file.

Critical Impact
Attackers can execute arbitrary code with the privileges of the current user after tricking a victim into opening a crafted Substance 3D Painter project file.

Affected Products

Adobe Substance 3D Painter 9.1.1
Adobe Substance 3D Painter versions prior to 9.1.1
Windows and macOS installations of Substance 3D Painter

Discovery Timeline

2024-02-15 - CVE-2024-20741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20741

Vulnerability Analysis

The flaw is a Write-what-where Condition tracked as [CWE-123]. This class of bug lets an attacker control both the value written and the destination address of the write. When combined with the Out-of-bounds Write component [CWE-787], the attacker can corrupt process memory in a directed way.

Substance 3D Painter parses complex project and asset file formats. A malformed structure inside such a file drives the vulnerable code path. The result is a controlled memory write outside the intended buffer boundary.

An attacker who controls both the write target and the payload can overwrite function pointers, virtual table entries, or return addresses. This converts memory corruption into arbitrary code execution inside the Substance 3D Painter process. Code runs with the same privileges as the user who opened the file.

Root Cause

The root cause is insufficient validation of offsets or indices used during file parsing. The application trusts attacker-controlled fields when computing a destination address for a write operation. Missing bounds checks allow the write to land at an arbitrary location in the process address space.

Attack Vector

The attack is local and requires user interaction. An attacker delivers a malicious Substance 3D Painter file through email, chat, a shared drive, or a compromised asset repository. The victim opens the file, and the parser triggers the write-what-where primitive during load.

No authentication to Adobe services is required. Exploitation does not need elevated privileges. The scope remains unchanged, and code executes as the current user.

No public proof-of-concept exploit is available for CVE-2024-20741. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.269% (percentile 19.094) as of 2026-08-18.

Detection Methods for CVE-2024-20741

Indicators of Compromise

Unexpected child processes spawned by Substance 3D Painter.exe or the macOS equivalent binary, especially command shells, PowerShell, or scripting engines
Substance 3D Painter project files arriving from untrusted sources such as external email, unmanaged file shares, or third-party asset marketplaces
Crash dumps or Windows Error Reporting entries referencing access violations inside the Substance 3D Painter process during file open operations

Detection Strategies

Monitor for anomalous process lineage where Substance 3D Painter launches interpreters, cmd.exe, powershell.exe, or network utilities such as curl or certutil
Alert on writes by the Substance 3D Painter process to autorun locations, scheduled task paths, or startup folders
Track outbound network connections initiated by Substance 3D Painter to hosts outside Adobe or approved asset services

Monitoring Recommendations

Enable endpoint telemetry for file open events targeting Substance 3D Painter project extensions and correlate with the source of the file
Collect memory-integrity and exploit-guard events on hosts running Substance 3D Painter to catch failed exploitation attempts
Review installed Substance 3D Painter versions across the fleet and flag any host still running 9.1.1 or earlier

How to Mitigate CVE-2024-20741

Immediate Actions Required

Upgrade Adobe Substance 3D Painter to a version later than 9.1.1 as documented in the Adobe Security Advisory APSB24-04
Block or quarantine Substance 3D Painter project files received from untrusted external sources until they can be reviewed
Instruct users to open only asset files from verified colleagues, licensed marketplaces, or internal repositories

Patch Information

Adobe addressed CVE-2024-20741 in the security update described in Adobe Security Advisory APSB24-04. The advisory lists the fixed version and covers additional issues resolved in the same release. Apply the update on every workstation running Substance 3D Painter.

Workarounds

Run Substance 3D Painter under a standard user account to limit the impact of code execution as the current user
Use application allowlisting to block execution of unsigned child processes started by Substance 3D Painter
Restrict inbound file sharing channels used to deliver 3D assets and scan attachments for Substance 3D Painter project file types

bash

# Query installed Substance 3D Painter version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Substance 3D Painter*" } |
  Select-Object DisplayName, DisplayVersion, Publisher